zgrat | 766C3EF7CE39A3100D2D70F7D2850FBF[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

766C3EF7CE39A3100D2D70F7D2850FBF.exe
Size

1.9MB
MD5

766c3ef7ce39a3100d2d70f7d2850fbf
SHA1

74f70854ac506195e1a8f51a2ee0e9651becb4ec
SHA256

3052de74bcdc2e2028ee5bd91e8ad654aa166d38a2715f3ac6e5a5501c1e14e8
SHA512

258e4cdca45f49115f6bd31550d60be54b719982b6d3df116e4803ec4e3a13f1618e0150393335622ee37edc833c9e1c48dcba1d1100669966069e6d1d508b96
SSDEEP

24576:GnbLsr3tUHGNeubPxQhoFiAjeklLkJ21m2gP2y22y3gzT/kFCQPYGftxMBQ:Gb4r3hgSQmiAKklLkkm2gUrErI1liB

Score

10^/10

zgrat

Malware Config

Signatures

Detect ZGRat V1 1 IoCs

resource	yara_rule
sample	family_zgrat_v1

Zgrat family
zgrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
766C3EF7CE39A3100D2D70F7D2850FBF.exe

Files

766C3EF7CE39A3100D2D70F7D2850FBF.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 880B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ